ICO Guidance on Subject Access Requests

Detected February 6th, 2026

Summary

The UK Information Commissioner's Office (ICO) has published guidance on subject access requests (SARs) under GDPR. The guidance is aimed at large businesses in the public, private, and third sectors, with resources also available for small businesses.

View original document View source feed page

What changed

The Information Commissioner's Office (ICO) has released updated guidance concerning subject access requests (SARs) under the UK GDPR. This guidance, available on the ICO's website, provides detailed information for organizations on how to recognize, respond to, and manage SARs, including when information can be withheld or a request refused. It also directs users to self-service tools, quick reference guides, and training videos.

Organizations, particularly large businesses in the public, private, and third sectors, should review this guidance to ensure their SAR handling processes are compliant with current data protection regulations. While this guidance is non-binding, adherence is crucial for managing data subject rights effectively and avoiding potential regulatory scrutiny. Small businesses are directed to separate resources tailored to their needs.

Source document (simplified)

Subject access requests (also known as SARs or right of access)

The guidance on this page is suitable for large businesses in the public, private and third sectors. Small businesses should use the resources on our small business web hub.

Help and support

Subject access request self service

Use this tool to get answers to your questions about subject access requests (SARs).

Find the right subject access request resources

A quick reference guide to help you find the content you need on each subject access request topic.

Brief guidance

A guide to subject access requests

Brief guidance about SARs including information about how to recognise and respond to a request, finding and providing the information and when you can withhold information or refuse a request.

Detailed guidance

Subject access requests (SARs, right of access)

What is a subject access request (SAR), how to recognise them, when and how to respond to them, when you can withhold information or refuse a request and how to manage health, social work and education information in relation to SARs